I calculate the mean of the four weeks using the aliases, but how do I calculate the standard deviation of the four points as well.
source="..." earliest=-0d@d latest=now
| stats count as Today
| appendcols
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count as SameDayOneWeekAgo]
| appendcols
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count as SameDayTwoWeeksAgo]
| appendcols
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count as SameDayThreeWeeksAgo]
| appendcols
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count as SameDayFourWeeksAgo]
| eval mean= ((SameDayOneWeekAgo + SameDayTwoWeeksAgo + SameDayThreeWeeksAgo + SameDayFourWeeksAgo)/4)
source="..." earliest=-0d@d latest=now
| stats count as Today
| append
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count]
| append
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count]
| append
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count]
| append
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count]
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev
source="..." earliest=-0d@d latest=now
| stats count as Today
| append
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count]
| append
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count]
| append
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count]
| append
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count]
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev
Each append adds an event with the count for that day, whereas the count for today is renamed Today. The stats outputs the value of Today's count, and the average and standard deviation of the count fields.
You may need to wait for the events to all be read before the standard deviation is calculated
Could you explain why that works? Also I didn't want to include today's value.